Attack vector for Composition Media (MIB2 non-nav)

[mattcabb]

It's not available on VW website anymore, but there was a single update package designed for all VW MIB2 devices (High/Std, Technisat/Delphi/Harman, nav/non-nav, ZR/PQ) - RSDB_VW_Multi_EU_v1.10.10.7z with radio station logo database.

Worth looking into it?

[olli991]

If you manage to get this update it's worth it. But would only work for Delphi because on Delphi the metainfo bug should work, except newest devices. They fixed this on newest ones.
On technisat the metainfo bug isn't working.

If you have this update please upload it or send it to me :) t.me/olli991

[olli991]

After inspecting the file I sadly don't see any attack vectors for technisat units in there.
But this could be a structure for a future toolbox for every unit. Maybe we can link Technisat variants to the current Online Approval Update, the other ones should have the "behind signature" metainfo bug and could be modified to what we want.
But RadioDB is custom SWDL... maybe not compatible with linked Online Approval Update... needs testing.

[mattcabb]

I just found this "behind signature" bug research that you mentioned above.
https://www.contextis.com/en/blog/a-code-signing-bypass-for-the-vw-polo

Is there any info about which software versions had this bug? Was this MIB2-wide or just a specific vendor in specific FW?

[lprot]

I just found this "behind signature" bug research that you mentioned above. https://www.contextis.com/en/blog/a-code-signing-bypass-for-the-vw-polo

Is there any info about which software versions had this bug? Was this MIB2-wide or just a specific vendor in specific FW?

All MIB2 STD Delphi before the latest revision.

[mattcabb]

Thanks for clearing that up. Damn Technisat 😉
So it's possible to patch Delphi with SD card alone, right?

[olli991]

Should be in theory. We wanted to test it but we both do not have a unit here to test it. I tested with one guy so far and we had no success. It's a bit complicated when you not have a unit yourself.

[zbadguy]

Hello olli991
Any more progress on non nav zr/pq?
Can't the toolbox be merged with the radio station db?

[olli991]

radio db sadly is no option. currently no progress or further investigations on this topic. Only emmc possible